Although e-commerce has grown exponentially in the recent past, problems that limit future growth remain. For example, many consumers who would otherwise be willing to transact or provide private information about themselves on-line do not do it because they are afraid that the Website operator has not taken sufficient security means to protect their private information such as their name, address, buying habits and credit card information.
FIG. 1 is a top-level block diagram illustrating an example environment of the invention. As shown in FIG. 1, the environment includes an on-line service 102 having one or more websites 104, and visitors 106 that access the website(s) of the on-line service via a network 108 such as the Internet. Only one service 102 and visitor 106 are shown in FIG. 1 for clarity of the invention. However, those skilled in the art will understand that there can be dozens, hundreds, thousands, and/or millions of each, depending on the type of network 108 involved.
On-line service 102 is typically an ecommerce operator, or other Internet or network service that obtains and/or maintains private or confidential information about consumers. Such service is interested in removing the fear and objections consumers may have about transacting with or sharing their personal information with the website(s) 104. Accordingly, service 102 may perform its own security oriented scans of the website and use the results to ensure that consumer information is secure. For example, such scans may be designed to detect vulnerabilities to threats such as hackers gaining access to the website(s) systems to deface the website, defraud the website's visitors or steal valuable information about the website or its visitors.
Visitor 106 is a consumer or other interested party visiting, or contemplating visiting, website(s) 104 or other Internet service provided by service 102 via a PC and a modem, web kiosk or other Internet access device. Visitor 106 can be a consumer or other interested party (not necessarily an individual consumer) interested in purchasing or in some way transacting with the service 102's on-line store, service or information base. Visitor 106 may not inherently trust on-line services and websites to protect their private and personal identifying, credit card, financial, medical or other information with sufficient security precautions to ensure its privacy and safety, and, indirectly the safety of the visitor.
Website 104 includes conventional system components for delivering on-line services to the visitor. As will be understood by those skilled in the art, components of website 104 can include, but are not limited to:                Servers, such as the Sun e220R, Dell 5500, or other computer system involved in providing a part of the service.        Network Components, such as network routers switches and Hubs.        Firewalls, such as Checkpoint, or Firebox        Operating Systems, such as Windows NT, Redhat Linux, or Sun Solaris        Licensed technology components and applications, such as web servers and application servers, e-commerce applications, RDBMS database engines, etc.        Customer written applications such as shopping carts, information systems containing private information about Visitors and other application components.        Network operating systems and protocols, such as SNMP, ICMP, TCP, IP, DHCP, IIOS and the like.        
Some attempts have recently been made to provide security verification so as to promote confidence in visitors 106 for conducting e-commerce and other transactions with services 102. For example, Verisign and Truste allow on-line services to place a seal (e.g. an image created by a .GIF or other image file) on their websites if they have purchased their products, but do not do any actual security testing of the sites themselves. Accordingly, such seals do not truly indicate the vulnerability of the services 102 to hacking, cracking, worms, trojans, or similar security vulnerabilities. Further, such seals do not themselves appraise visitors of the security of data held on the website 104, or otherwise audit the security precautions of services 102 in any way.
For example, Verisign does not scan their customers' servers for any security vulnerabilities. In fact, Verisign does not even verify the proper installation of the Verisign digital certificate (a string of numbers which is a public key infrastructure (PKI) encryption technology) or use of secure sockets layer (SSL) to ensure the security of a visitor's transaction packets. As set forth above, the Verisign seal itself does nothing to verify to visitors 106 that the services 102 are not vulnerable to hacking, cracking, worms, trojans or similar security vulnerabilities. A user can click on the Verisign seal and Verisign will merely display a single web page showing that the service 102 has purchased a Verisign digital certificate or other product and that Verisign has verified their identity.
Similarly, Truste does not test the security of the networks and servers that operate the ecommerce systems that use their seal. When a Truste seal is purchased, Truste will merely verify that the service's privacy policy meets the Truste requirements and will look at the website to verify that it appears to comply with that policy, but will not otherwise check the actual security of the servers and networking equipment which deliver the services 102.
As another example, some attempts have been made to provide third-party verification of on-line services, such as verification services performed by Qualys. Such third-party verification services may use open source tools such as those provided by www.nessus.org. However, Qualys and others do not offer a seal or other means for visitors 106 to access the results of such verification services or to otherwise verify the actual security of the services 102. Furthermore, Qualys and others do not check for potential new server vulnerabilities between automated security checks of the website 104 used to operate the services 102. For example, scans may only be performed on a periodic or infrequent basis, while potential new security threats, such as worms, may arise several times a day. There is currently no way for such third-party approaches to alert services 102 of such potential new threats between scans.
In summary, none of the above conventional approaches are entirely trustworthy, do not adequately check and alert service 102 of potential new threats between security scans and/or are directly available to visitors 106.